Index: http.c
===================================================================
--- http.c	(revision 6494)
+++ http.c	(working copy)
@@ -335,6 +335,11 @@
     major_status = gss_release_name(&minor_status, &http->gssname);
 #endif /* HAVE_GSSAPI */
 
+#ifdef HAVE_AUTHORIZATION_H
+  if (http->auth_ref)
+    AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults);
+#endif /* HAVE_AUTHORIZATION_H */
+
   httpClearFields(http);
 
   if (http->authstring && http->authstring != http->_authstring)
@@ -2574,10 +2579,12 @@
   httpClearFields(http);
 
  /*
-  * The Kerberos authentication string can only be used once...
+  * The Kerberos and AuthRef authentication strings can only be used once...
   */
 
-  if (http->authstring && !strncmp(http->authstring, "Negotiate", 9))
+  if (http->authstring && 
+      (!strncmp(http->authstring, "Negotiate", 9) || 
+       !strncmp(http->authstring, "AuthRef", 7)))
   {
     http->_authstring[0] = '\0';
 
Index: auth.c
===================================================================
--- auth.c	(revision 6494)
+++ auth.c	(working copy)
@@ -468,17 +468,17 @@
   * Delete any previous authorization reference...
   */
   
-  if (cg->auth_ref)
+  if (http->auth_ref)
   {
-    AuthorizationFree(cg->auth_ref, kAuthorizationFlagDefaults);
-    cg->auth_ref = NULL;
+    AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults);
+    http->auth_ref = NULL;
   }
 
   if (httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", 
 		       auth_key, sizeof(auth_key)))
   {
     status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, 
-				 kAuthorizationFlagDefaults, &cg->auth_ref);
+				 kAuthorizationFlagDefaults, &http->auth_ref);
     if (status != errAuthorizationSuccess)
     {
       DEBUG_printf(("cups_local_auth: AuthorizationCreate() returned %d (%s)\n",
@@ -499,11 +499,11 @@
 		 kAuthorizationFlagInteractionAllowed | 
 		 kAuthorizationFlagExtendRights;
 
-    status = AuthorizationCopyRights(cg->auth_ref, &auth_rights, 
+    status = AuthorizationCopyRights(http->auth_ref, &auth_rights, 
 				     kAuthorizationEmptyEnvironment, 
 				     auth_flags, NULL);
     if (status == errAuthorizationSuccess)
-      status = AuthorizationMakeExternalForm(cg->auth_ref, &auth_extrn);
+      status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn);
 
     if (status == errAuthorizationSuccess)
     {
Index: request.c
===================================================================
--- request.c	(revision 6494)
+++ request.c	(working copy)
@@ -71,9 +71,6 @@
   int		bytes;			/* Number of bytes read/written */
   char		buffer[32768];		/* Output buffer */
   http_status_t	expect;			/* Expect: header to use */
-#ifdef HAVE_AUTHORIZATION_H
-  _cups_globals_t *cg = _cupsGlobals();	/* Global data */
-#endif /* HAVE_AUTHORIZATION_H */
 
 
   DEBUG_printf(("cupsDoFileRequest(%p, %p, \'%s\', \'%s\')\n",
@@ -450,18 +447,6 @@
     }
   }
 
-#ifdef HAVE_AUTHORIZATION_H
- /*
-  * Delete any authorization reference created for this request...
-  */
-  
-  if (cg->auth_ref)
-  {
-    AuthorizationFree(cg->auth_ref, kAuthorizationFlagDefaults);
-    cg->auth_ref = NULL;
-  }
-#endif /* HAVE_AUTHORIZATION_H */
-
   return (response);
 }
 
Index: http-private.h
===================================================================
--- http-private.h	(revision 6494)
+++ http-private.h	(working copy)
@@ -73,6 +73,10 @@
 #    endif /* !HAVE_GSS_C_NT_HOSTBASED_SERVICE */
 #  endif /* HAVE_GSSAPI */
 
+#  ifdef HAVE_AUTHORIZATION_H
+#    include <Security/Authorization.h>
+#  endif /* HAVE_AUTHORIZATION_H */
+
 #  if defined(__sgi) || (defined(__APPLE__) && !defined(_SOCKLEN_T))
 /*
  * IRIX and MacOS X 10.2.x do not define socklen_t, and in fact use an int instead of
@@ -193,6 +197,11 @@
   gss_ctx_id_t		gssctx;		/* Authentication context @since CUPS 1.3@ */
   gss_name_t		gssname;	/* Authentication server name @since CUPS 1.3@ */
 #  endif /* HAVE_GSSAPI */
+
+#ifdef HAVE_AUTHORIZATION_H
+  /* auth.c */
+  AuthorizationRef	auth_ref;	/* Authorization ref */
+#endif /* HAVE_AUTHORIZATION_H */
 };
 
 
Index: globals.c
===================================================================
--- globals.c	(revision 6494)
+++ globals.c	(working copy)
@@ -180,11 +180,6 @@
 
   cupsFreeOptions(cg->cupsd_num_settings, cg->cupsd_settings);
 
-#ifdef HAVE_AUTHORIZATION_H
-  if (cg->auth_ref)
-    AuthorizationFree(cg->auth_ref, kAuthorizationFlagDefaults);
-#endif /* HAVE_AUTHORIZATION_H */
-
   free(value);
 }
 
Index: globals.h
===================================================================
--- globals.h	(revision 6494)
+++ globals.h	(working copy)
@@ -40,11 +40,7 @@
 #    include <pthread.h>
 #  endif /* HAVE_PTHREAD_H */
 
-#  ifdef HAVE_AUTHORIZATION_H
-#    include <Security/Authorization.h>
-#  endif /* HAVE_AUTHORIZATION_H */
 
-
 /*
  * C++ magic...
  */
@@ -130,11 +126,6 @@
 					/* Default printer */
   char			ppd_filename[HTTP_MAX_URI];
 					/* PPD filename */
-
-#ifdef HAVE_AUTHORIZATION_H
-  /* auth.c */
-  AuthorizationRef	auth_ref;	/* Authorization ref */
-#endif /* HAVE_AUTHORIZATION_H */
 } _cups_globals_t;